KR102094923B1 - Cloud service system to which service mesh - Google Patents

Abstract

According to the present invention, a cloud service system to which a service mesh is applied comprises: a control tower which is a logical entity for managing the entire infrastructure; a number of functions connected to a network; and a proxy which monitors state information of traffic passing through the function, transmits the state information to the control tower, and processes the traffic according to a command transmitted from the control tower. The service mesh is a network adaptive service mesh operating based on network recognition.

Description

Cloud service system to which service mesh is applied {CLOUD SERVICE SYSTEM TO WHICH SERVICE MESH}

The present invention relates to a cloud service system to which a network adaptive service mesh operating based on network level, network plane, network slice, and perception of network traffic is applied.

The cloud service has the advantage of reducing the IT cost of the user and improving the agility and efficiency of resource operation, and various cloud services are being operated based on this advantage.

On the other hand, interconnection through an application-to-application network is becoming important, but the network infrastructure has limited bandwidth and does not guarantee connection stability. Therefore, there are emerging techniques to resolve and solve the interrelated problems in these situations. This technique is called a service mesh.

The service mesh is a layer located between the infrastructure layer and the application layer, and provides monitoring and control for robust quality of service (QoS) to be provided on an unstable network infrastructure with limited bandwidth.

Meanwhile, the existing service mesh technology has the following problems.

First, the service mesh proxy relies heavily on the HTTP protocol because it is based on the HTTP proxy. Accordingly, there is a problem in that it is difficult to closely monitor traffic over information provided by the HTTP header.

Also, the control / monitoring plane and the data plane were not separated. Accordingly, it is possible for the user's application on the shared resource to unauthorizedly access and interfere with the shared resource by manipulating the service mesh supporting it.

Also, it was entirely dependent on CPU operation and mapping with a specific infrastructure was impossible. Accordingly, it was impossible to use specialized hardware to support network processing, and it was impossible to link with network slicing, etc., which divide the infrastructure.

Therefore, there is a need for a service mesh technology that is not tied to the protocol, and the control / monitoring plane on the shared resource is completely separated from the data plane so that the user cannot view or manipulate it, and it is possible to slice specialized hardware and networks through mapping with specific infrastructure. Was done.

(Patent Document 1) US9519520 B2

The present invention is to solve the above-mentioned problems, the object of the present invention is to provide a cloud service system to which a network adaptive service mesh is applied that operates based on network level, network plane, network slice, and network traffic awareness. It is to do.

According to an embodiment of the present invention, a cloud service system to which a service mesh is applied includes a control tower that is a logical entity that manages the entire infrastructure, a plurality of functions connected to a network, and passes through the functions. A network adaptive service mesh operating based on network awareness, including a proxy that monitors traffic state information and transmits it to the control tower, and processes the traffic according to a command transmitted from the control tower. to be.

According to an embodiment of the present invention, a traffic transmission method of a cloud service system to which a service mesh is applied determines a network slice through which a transmission node transmits service traffic based on a command and status information of a network slice connected to the transmission node. , Encapsulating the service traffic, and transmitting the encapsulated traffic, the intermediate node receiving the encapsulated traffic, and servicing traffic based on status information of a network slice connected to the intermediate node Determining a network slice to transmit, transmitting the encapsulated traffic, and a receiving node receiving the encapsulated traffic and decapsulating the encapsulated traffic to receive the service traffic. And obtaining.

1 is a view for explaining a problem in the conventional service mesh.
2 is a diagram illustrating a cloud service system to which a service mesh is applied according to an embodiment of the present invention.
3 and 4 are diagrams for explaining network slice recognition, network connection recognition, and network traffic recognition.
5 to 7 are flow charts illustrating the flow of traffic of the present invention.
8 is a diagram for explaining a process of processing a DNS query according to an embodiment of the present invention.

Hereinafter, exemplary embodiments disclosed herein will be described in detail with reference to the accompanying drawings, but the same or similar elements are assigned the same reference numbers regardless of the reference numerals, and overlapping descriptions thereof will be omitted. The suffixes "modules" and "parts" for the components used in the following description are given or mixed only considering the ease of writing the specification, and do not have meanings or roles distinguished from each other in themselves. In addition, in describing the embodiments disclosed in the present specification, when it is determined that detailed descriptions of related known technologies may obscure the gist of the embodiments disclosed herein, detailed descriptions thereof will be omitted. In addition, the accompanying drawings are only for easy understanding of the embodiments disclosed in the present specification, and the technical spirit disclosed in the specification is not limited by the accompanying drawings, and all modifications included in the spirit and technical scope of the present invention , It should be understood to include equivalents or substitutes.

Terms including ordinal numbers such as first and second may be used to describe various components, but the components are not limited by the terms. The terms are used only for the purpose of distinguishing one component from other components.

When an element is said to be "connected" or "connected" to another component, it is understood that other components may be directly connected to or connected to the other component, but may exist in the middle. It should be. On the other hand, when a component is said to be "directly connected" or "directly connected" to another component, it should be understood that no other component exists in the middle.

Singular expressions include plural expressions unless the context clearly indicates otherwise. In this application, the terms "comprises" or "have" are intended to indicate the presence of features, numbers, steps, actions, components, parts or combinations thereof described herein, one or more other features. It should be understood that the existence or addition possibilities of fields or numbers, steps, operations, components, parts or combinations thereof are not excluded in advance.

1 is a view for explaining a problem in the conventional service mesh.

In the cloud service system, there are multiple functions and proxies corresponding to each of the multiple functions, and the proxies are connected to each other in the form of a mesh, and the proxies are connected to the control tower to report the traffic status information to the control tower. , Controls traffic by receiving an instruction according to the network policy from the control tower.

If an example of one proxy 110 and function 120 is described, the proxy 110 shares a network stack with a function 120 and flows into the function 120 It monitors real-time or outgoing network traffic in real time, transmits the monitored information to the control tower, and controls traffic according to the control tower's instructions.

Meanwhile, along with the traffic, meta data including instructions transmitted from the control tower or state information of the network flows in.

On the other hand, in the past, since the proxy 110 and the function 120 share a network stack, and the monitoring / control plane and the data plane are not separated, but share one plane 130, The function 120 could glimpse messages coming and going from the proxy.

Accordingly, a malicious user may have a problem in that the infrastructure is operated without permission, such as by manipulating or blocking an instruction, or by manipulating and exporting monitoring data.

In addition, since the monitoring / control plane and the data plane are not separated and the data traffic and the monitoring / control traffic are not divided and processed, all traffic must go through the proxy's monitoring / control plane. Accordingly, when there is a lot of traffic, the proxy becomes a bottleneck.

2 is a diagram illustrating a cloud service system to which a service mesh is applied according to an embodiment of the present invention.

The control tower 210 is a logical entity that centrally manages the entire infrastructure, and performs the operation and management of the infrastructure.

The cloud service system operates in such a way that the control tower 210 provides a service for efficiently distributing and managing resources of the under cloud.

When a developer wants to perform his / her business, that is, to use his cloud service, a request is made to an operator who manages the control tower 210. The operator side uses the resources of the under cloud to provide a cloud service corresponding to the developer's request. Accordingly, the developer operates his own development center and his own developer data storage overcloud.

Meanwhile, the control tower 210 may control all proxy and security information corresponding to functions in the form of physical (P), virtual machine (V), or container (C).

Therefore, regardless of the physical (P), virtual machine (V), or container (C) type, the control tower 210 communicates with proxy and security infors through a unified API to support the three resource types in an integrated form. You can.

In addition, since only a proxy exchanges network information with an adjacent proxy, there is a limit in understanding the network status, so the control tower 120 can receive the status information of the network from each proxy. Accordingly, the control tower 120 can grasp the network condition of the entire service mesh and perform central control.

In addition, the control tower 120 may provide a proxy for each service, which is required in advance when proxies process service traffic, through an API. Here, the policy may mean a network quality of service (QOS) requirement for traffic for each service (for example, a delay rate, a loss rate, a transmission rate, etc.).

Meanwhile, a plurality of nodes may be connected to each other in a mesh form, and the plurality of nodes may be connected to a control tower.

Meanwhile, the function 240 and the proxy 230 corresponding to the function 240 may configure one node 220.

Therefore, a number of functions in the cloud service system can be connected to a network. In addition, proxies corresponding to a plurality of functions are connected to each other in the form of a mesh, and the proxies are connected to the control tower to report the status information of the traffic to the control tower, and commands according to network policy from the control tower. Traffic can be controlled by receiving an (instruction).

In addition, the proxy 230 may monitor and transmit status information of traffic passing through the function 240 corresponding to the proxy (flowing into or out of the function 240) to the control tower. Also, the proxy 230 may control traffic passing through the function 240 according to an instruction transmitted from the control tower.

On the other hand, the function is for a service (or a micro service), and may mean one container or a collection of containers, and the function may be composed of a physical (P) or virtual machine (V) as well as a container (C). .

Meanwhile, the present invention relates to a cloud service system to which a service mesh is applied, and the service mesh described in the present invention is a network-aware service mesh that operates based on network aware service. It may be an improved form of the mesh.

Here, network aware is at least one of network level-aware, network plane-aware, network slice-aware, and network traffic-aware. It may include.

First, Network Plane-aware will be described.

Network Plane-aware

The traffic flowing into the function 240 may include metadata including monitoring information along with service traffic required by the function 240.

That is, the traffic flowing into the function may be traffic in which service traffic transmitted to the function 240 and metadata transmitted to the proxy are encapsulated.

Meanwhile, service traffic may be data exchanged between functions for service. In addition, the monitoring information may include network status information (for example, network slice status information) or traffic status information such as traffic transmission status, success rate, and delay rate.

Meanwhile, the control tower may provide an instruction to the proxy 230 through an API based on a policy for a service. Here, the policy may mean a network quality of service (QOS) requirement for traffic (for example, a delay rate, a loss rate, a transmission rate, etc.).

In this case, the proxy 230 may receive an instruction from the control tower, and generate a decision based on the received instruction. In addition, the proxy 230 may process traffic according to a decision, that is, control traffic such as traffic passing or blocking.

Meanwhile, the proxy 230 may classify and process traffic flowing into a function into a monitoring / control plane 250 and a data plane 260.

Specifically, the proxy may decapsulate the encapsulated traffic flowing into the function, and separate the traffic into service traffic and metadata for service provision, and process the traffic.

In this case, service traffic may be transmitted to the function 240 on the data plane 260. Meta data may also be transmitted to the proxy 230 on the monitor / control plane 250.

That is, the control / monitoring plane and the data plane are separated, and in the decapsulation process, all monitoring / control traffic is filtered so that only the control plane traffic can reach the function. In addition, the control / monitoring plane only makes traffic decisions, and the actual traffic processing can be done in the data plane.

Meanwhile, the proxy may acquire monitoring information, that is, network status information or traffic status information using meta data. In addition, the proxy may transmit monitoring information to the control tower through the API.

Meanwhile, the proxy 230 may generate metadata by recording traffic state information. In addition, the proxy may encapsulate service traffic and generated meta data flowing out of the function 240.

Meanwhile, the proxy 230 may process encapsulated traffic according to a command provided from the control tower. That is, the proxy 230 may transmit traffic by establishing a route according to the control tower policy.

According to the present invention, by separating the control / monitoring channel from the data channel, sensitive information such as network slice state information and traffic transmission state information may not be exposed to the user.

In addition, only control / monitoring traffic goes through the control / monitoring plane of the proxy, thereby preventing the bottleneck occurring in the proxy.

Next, network slice-aware will be described.

Network slice-aware

3 and 4, the cloud service system may include an intermediate node 310 including a proxy 410.

The intermediate node 310 is an intermediate stopover node through which the traffic passes, and is a node that switches a network slice through which the traffic passes or processes the traffic intermediately.

A plurality of network slices of different quality may be connected to the intermediate node 310.

The network slice can have features. Here, the characteristics may refer to quality such as delay rate and throughput, and characteristics between network slices may be different from each other.

Meanwhile, the proxy 410 included in the intermediate node 310 knows in advance the network status between nodes by constantly exchanging status information of network slices between adjacent nodes.

That is, if the existing service mesh only evaluates traffic between micro-services, the network adaptive service mesh of the present invention can collect the information of the underlay network to grasp the state information of the network slice.

Meanwhile, the proxy 410 included in the intermediate node 310 may evaluate how satisfied the QoS (eg, delay rate, loss rate, transmission rate, etc.) required by the traffic when the traffic is brokered.

And when transmitting traffic to the next node, the proxy 410 included in the intermediate node 310 selects the optimal network slice that satisfies the QoS requirements of the traffic based on the status information of the network slice and the QoS requirements of the traffic. Traffic.

Next, network traffic-aware will be described.

Network Traffic-aware

The intermediate node 310 may perform not only a simple relay of traffic, but also an encryption status check, ACL filtering, and delivery failure processing when a problem occurs. In this case, encryption status checking, ACL filtering, and delivery failure processing in the event of a problem may be performed by a security informationr 420 (security enforcer) included in the intermediate node 310.

Meanwhile, the cloud service system may include a node on the transmission side. Here, the transmitting node may include a microservice, a proxy corresponding to the transmitting microservice, and a security information sheet corresponding to the transmitting microservice.

The microservice on the transmission side may transmit the traffic as plaintext traffic or encrypted traffic.

On the other hand, when the microservice of the transmitting side transmits the traffic as plaintext traffic, the security information corresponding to the microservice of the transmitting side may encrypt the plaintext traffic and change it into encrypted traffic.

In this case, the encryption of plain text traffic can be performed by TrafficCrypto in the security information sheet.

On the other hand, when the traffic is received from the intermediate node, the security information contained in the intermediate node may perform ACL filtering to receive traffic only from the allowed targets or send traffic only to the allowed targets.

In addition, the security information contained in the intermediate node can check the encryption status of the traffic and perform delivery failure processing when a problem occurs.

Meanwhile, the cloud service system may include a receiving node. Here, the receiving node may include a receiving microservice, a proxy corresponding to the receiving microservice, and a security information sheet corresponding to the receiving microservice.

The security information sheet corresponding to the receiving microservice may decrypt the encrypted traffic to obtain plaintext traffic, and transmit the plaintext traffic to the receiving microservice.

In other words, in the case of plaintext transmission, which may be a security concern in microservices, the Security Enforcer intervenes in the intermediate step to encrypt and transmit the traffic. Then, the security information of the receiving side decrypts, so the microservice of the receiving side receives the traffic in plain text. Therefore, it is possible to reduce the need to consider encryption in the micro service itself, and improve security because the encryption process is not recognized in the middle of the user's viewpoint.

On the other hand, the security infoter can perform processing for DNS queries.

Specifically, the microservice can send DNS queries. Here, the DNS query may be plain text.

In this case, the security information sheet corresponding to the micro service may encrypt the DNS query and transmit the encrypted DNS query to a dedicated server.

In this case, the encryption of the plaintext DNS query can be performed by DNS Crypto in the security information sheet.

In addition, when an encrypted response to the DNS query is received from the dedicated server, the security information server corresponding to the microservice may decrypt the encrypted response and transmit a plaintext response to the microservice.

DNS queries are all plain text, so most microservices are also aligned. Therefore, in the related art, the user can change the destination of the query through manipulation of the query. However, the present invention blocks DNS forgery and surveillance by encrypting the DNS query in an intermediate step and safely transmitting it to the DNS server, and receiving the encrypted form of the reply and passing it back to the microservice in plain text to ensure compatibility with the microservice while maintaining DNS You can guarantee the safety of the query.

The following describes network level-aware.

Network level-aware

The function may be in the form of physical (P), virtual machine (V) or container (C).

In addition, the control tower can collectively control proxy and security information sheets corresponding to various types of functions. To this end, the control tower can communicate with a plurality of proxies and security infors corresponding to a plurality of different types of functions with a unified API.

In other words, the control tower, proxy, and security infors can communicate with a unified API regardless of the type of function so that the function can perform the same function regardless of the environment such as physical, virtual machine, and container.

Since the proxy reports all network status information of the node on which it is deployed to the control tower, the control tower can grasp the network status where the network adaptive service mesh is deployed. Accordingly, the control tower can easily set the QoS policy for each service to the proxies based on this information, and can collectively control three types of physical, virtual machine, and container.

5 to 7 are flow charts illustrating the flow of traffic of the present invention.

First, the flow chart is described in a large frame. The sender node determines a network slice to transmit service traffic based on the command and status information of the network slice connected to the transmit node, encapsulates service traffic, and prints Encapsulated traffic can be transmitted.

The intermediate node may receive the encapsulated traffic, determine a network slice to transmit service traffic based on the state information of the network slice connected to the intermediate node, and transmit the encapsulated traffic.

In addition, a receiving node may receive encapsulated traffic and decapsulate the encapsulated traffic to obtain service traffic.

Hereinafter, a traffic transmission method of a cloud service system to which a service mesh is applied will be described in more detail with reference to FIGS. 5 to 7.

The microservice on the transmission side corresponding to the transmission node may transmit the service traffic as plaintext traffic or encrypted traffic (S511).

On the other hand, the security information sheet corresponding to the transmitting node may perform ACL filtering to check whether service traffic is transmitted to the permitted destination, and if it is not permitted, transmit a traffic rejection notification to the microservice.

On the other hand, if the target is allowed, the security information can encrypt the service traffic (S515). In this case, the security infomer can encrypt plaintext traffic and convert it into encrypted traffic.

In addition, the security infoter can transmit the encrypted traffic to the proxy corresponding to the transmitting node.

Meanwhile, the proxy corresponding to the transmitting node may share the status information of the network slice with the neighboring node, and determine a network slice to transmit the service traffic based on the command reflecting the policy for the service and the status information of the network slice connected to the transmitting node. .

In addition, the proxy corresponding to the transmitting node encapsulates the encrypted service traffic together with the metadata, and transmits the encapsulated traffic (S517).

Meanwhile, the proxy corresponding to the intermediate node may receive encapsulated traffic and decapsulate the received encapsulated traffic to obtain encrypted traffic (S519). In addition, the proxy corresponding to the intermediate node may transmit encrypted traffic to the security informationr corresponding to the intermediate node.

The security information server corresponding to the intermediate node may ACL-filter the encrypted traffic (S521).

In addition, if the traffic is not received from the allowed target, the security information corresponding to the intermediate node may transmit a traffic rejection notification to the proxy corresponding to the intermediate node. In this case, the proxy corresponding to the intermediate node may send a delivery failure notification to the proxy corresponding to the transmitting node.

On the other hand, in the case of traffic received from the allowed target, the security information corresponding to the intermediate node may check the validity of the encrypted traffic (S523).

On the other hand, if the encrypted traffic is invalid, the security infotor corresponding to the intermediate node may transmit a traffic rejection notification to the proxy corresponding to the intermediate node. In this case, the proxy corresponding to the intermediate node may send a delivery failure notification to the proxy corresponding to the transmitting node.

On the other hand, when the encrypted traffic is valid, the security information server corresponding to the intermediate node may transmit the encrypted traffic to the proxy corresponding to the intermediate node (S525).

Meanwhile, the proxy corresponding to the intermediate node can share the state information of the network slice with the neighboring node, and determine a network slice to transmit service traffic based on the command according to the policy for the service and state information of the network slice connected to the intermediate node. have.

Then, the proxy corresponding to the intermediate node may encapsulate the encrypted traffic together with the metadata, and transmit the encapsulated traffic (S527).

Meanwhile, the proxy corresponding to the receiving node may receive encapsulated traffic, and decapsulate the received encapsulated traffic to obtain encrypted traffic (S529). In addition, the proxy corresponding to the receiving node may transmit the encrypted traffic to the security informationr corresponding to the receiving node.

In this case, the security information sheet corresponding to the receiving node may ACL-filter the encrypted traffic (S531).

In addition, if the traffic is not received from the allowed target, the security information corresponding to the receiving node may transmit a traffic rejection notification to the proxy corresponding to the receiving node. In this case, the proxy corresponding to the receiving node may send a delivery failure notification to the proxy corresponding to the intermediate node. In addition, the proxy corresponding to the intermediate node transmits a delivery failure notification to the proxy corresponding to the transmitting node, and the proxy corresponding to the transmitting node delivers delivery failure notification to the microservice corresponding to the transmitting node. Can send.

On the other hand, in the case of traffic received from the allowed target, the security information corresponding to the receiving node may check the validity of the encrypted traffic (S533).

On the other hand, if the encrypted traffic is invalid, the security infotor corresponding to the receiving node may transmit a traffic rejection notification to the proxy corresponding to the receiving node. In this case, the proxy corresponding to the receiving node may send a delivery failure notification to the proxy corresponding to the intermediate node. In addition, the proxy corresponding to the intermediate node transmits a delivery failure notification to the proxy corresponding to the transmitting node, and the proxy corresponding to the transmitting node delivers delivery failure notification to the microservice corresponding to the transmitting node. Can send.

On the other hand, if the encrypted traffic is valid, the security information processor corresponding to the receiving node may decrypt the encrypted traffic to obtain plain text traffic and transmit the plain text traffic to the microservice corresponding to the receiving node (S535).

Meanwhile, when the microservice corresponding to the transmitting node initially transmits the encrypted traffic, the security importer corresponding to the receiving node may transmit the encrypted traffic to the microservice corresponding to the receiving node without the decryption process.

On the other hand, when the encrypted traffic is valid, the security information server corresponding to the receiving node may transmit a delivery rejection notification to the proxy corresponding to the receiving node.

8 is a diagram for explaining a process of processing a DNS query according to an embodiment of the present invention.

The microservice corresponding to the transmitting node may transmit a plaintext DNS query (S601).

On the other hand, the security information sheet corresponding to the transmitting node performs ACL filtering to check whether a DNS query is transmitted to an allowed destination, and if it is not allowed, a traffic rejection notification to a microservice.

On the other hand, if allowed, the security infomer can encrypt the plaintext DNS query and send it to a trusted public DNS server.

On the other hand, the security information sheet corresponding to the transmitting node may receive an encrypted response from the server and decrypt the encrypted response to obtain a response in plain text.

In addition, the security information sheet corresponding to the transmitting node may transmit a response of the plaintext to the microservice corresponding to the transmitting node (S605).

The above-described present invention can be embodied as computer readable codes on a medium on which a program is recorded. The computer-readable medium includes any kind of recording device in which data readable by a computer system is stored. Examples of computer-readable media include a hard disk drive (HDD), solid state disk (SSD), silicon disk drive (SDD), ROM, RAM, CD-ROM, magnetic tape, floppy disk, and optical data storage device. There is this. The above detailed description should not be construed as limiting in all respects and should be considered illustrative. The scope of the present invention should be determined by rational interpretation of the appended claims, and all changes within the equivalent scope of the present invention are included in the scope of the present invention.

Claims (16)

In the cloud service system to which the service mesh is applied,
A control tower, which is a logical entity managing the entire infrastructure;
A plurality of functions connected to a network; And
It includes; a proxy for monitoring status information of traffic passing through the function and transmitting it to the control tower, and processing the traffic according to a command transmitted from the control tower.
The service mesh,
It is a network adaptive service mesh that operates based on network awareness.
The proxy,
The traffic flowing into the function is decapsulated to separate the traffic into service traffic for providing metadata and services, and processing
The service traffic is transmitted to the function on the data plane,
The metadata is transmitted to the proxy on the monitor / control plane.
Cloud service system to which service mesh is applied. delete delete According to claim 1,
The proxy,
Using the metadata to obtain the status information of the traffic to transmit to the control tower
Cloud service system to which service mesh is applied. The method of claim 4,
The proxy,
Encapsulating service traffic and meta data flowing out of the function, and transmitting the traffic according to the command
Cloud service system to which service mesh is applied. According to claim 1,
Intermediate node including a proxy; further comprises,
A plurality of network slices of different quality are connected to the intermediate node,
The proxy corresponding to the intermediate node shares state information of the plurality of network slices with an adjacent node.
Cloud service system to which service mesh is applied. The method of claim 6,
The proxy corresponding to the intermediate node,
Transmitting the traffic using a network slice that satisfies the QOS requirement of traffic passing through the intermediate node
Cloud service system to which service mesh is applied. The method of claim 6,
Further comprising a security information sheet corresponding to the micro-service of the transmission side,
The security information sheet corresponding to the micro-service of the transmission side,
When the plaintext traffic is transmitted from the microservice of the transmitting side, the plaintext traffic is encrypted.
Cloud service system to which service mesh is applied. The method of claim 8,
Further comprising a security information sheet corresponding to the receiving micro-service,
The security information sheet corresponding to the receiving microservice,
Decrypting the encrypted traffic to transmit plaintext traffic to the receiving microservice
Cloud service system to which service mesh is applied. The method of claim 8,
The traffic,
Service traffic and DNS traffic for the provision of services,
The security information book,
The DNS traffic is encrypted and transmitted to a DNS server, and when an encrypted response is received from the DNS server, the encrypted response is decrypted to transmit plaintext DNS traffic to the microservice.
Cloud service system to which service mesh is applied. The method of claim 8,
The function (function),
In the form of a physical, virtual machine or container,
The control tower has a plurality of proxies and security corresponding to a plurality of functions of different shapes so that the control tower can collectively control proxies and security information sheets corresponding to functions in the form of physical, virtual machines or containers. To communicate with the Informer and a unified API
Cloud service system to which service mesh is applied. Determining, by a transmitting node, a network slice to transmit service traffic based on the command and status information of a network slice connected to the transmitting node, encapsulating the service traffic, and transmitting the encapsulated traffic;
An intermediate node receiving the encapsulated traffic, determining a network slice to transmit service traffic based on status information of a network slice connected to the intermediate node, and transmitting the encapsulated traffic; And
And a receiving node receiving the encapsulated traffic and decapsulating the encapsulated traffic to obtain the service traffic.
The intermediate node, transmitting the encapsulated traffic,
A proxy corresponding to the intermediate node receiving the encapsulated traffic, and decapsulating the encapsulated traffic;
Filtering the encrypted traffic obtained by decapsulating the encapsulated traffic by the security informationr corresponding to the intermediate node; And
The security information corresponding to the intermediate node, if it is determined that the encrypted traffic is valid, transmitting the encrypted traffic to the proxy corresponding to the intermediate node; includes
Traffic transmission method of cloud service system to which service mesh is applied. The method of claim 12,
The transmitting node transmitting the encapsulated traffic,
Transmitting, by the micro-service corresponding to the transmitting node, the service traffic;
Filtering and encrypting the service traffic by the security informationr corresponding to the transmitting node;
A proxy corresponding to the transmitting node shares state information of a network slice with an adjacent node, and determines a network slice to transmit service traffic based on an instruction and state information of the network slice connected to the transmitting node; And
And a proxy corresponding to the transmitting node encapsulating the encrypted service traffic and transmitting the encapsulated traffic.
Traffic transmission method of cloud service system to which service mesh is applied. The method of claim 12,
The intermediate node, transmitting the encapsulated traffic,
A proxy corresponding to the intermediate node, sharing state information of a network slice with an adjacent node, and determining a network slice to transmit service traffic based on an instruction and state information of a network slice connected to the intermediate node; And
And the proxy corresponding to the intermediate node encapsulates the encrypted traffic and transmits the encapsulated traffic.
Traffic transmission method of cloud service system to which service mesh is applied. The method of claim 12,
The receiving node obtaining the service traffic comprises:
A proxy corresponding to the receiving node receiving the encapsulated traffic, and decapsulating the encapsulated traffic;
Filtering the encrypted traffic obtained by decapsulating the encapsulated traffic by the security informationr corresponding to the receiving node;
When the security information corresponding to the receiving node determines that the encrypted traffic is valid, decrypts the encrypted traffic to obtain plaintext traffic, and transmits the plaintext traffic to the microservice corresponding to the receiving node. Step; containing
Traffic transmission method of cloud service system to which service mesh is applied. The method of claim 12,
Sending, by the microservice corresponding to the transmitting node, a DNS query in plain text;
Encrypting a DNS query of the plain text by the security information server corresponding to the transmitting node and transmitting the encrypted query to a server;
A security informationr corresponding to the transmitting node receiving an encrypted response from the server, and decrypting the encrypted response to obtain a response in plain text; And
The security information sheet corresponding to the transmitting node transmits the response of the plaintext to the microservice corresponding to the transmitting node.
Traffic transmission method of cloud service system to which service mesh is applied.

Images